Privacy Policy
Philosophy
Your current is sacred. We don’t extract it; we witness it. Our privacy model is inverted: your privacy equals our privacy. We protect your process the same way you would protect your own.
Raw material is compostable; we burn it. Only the card—your final composition—persists.
What This Policy Covers
This Privacy Policy explains how Composium OY (“we,” “us,” “our”) collects, uses, stores, and protects personal data when you access or use Composium (the service provided via composium.co, composium.studio, and composium.app).
By clicking “Conduct a Composition” or otherwise using the service, you acknowledge and agree to this Privacy Policy and our Terms of Use.
1. What We Collect at Entry
When you begin a composition session on composium.app, we record three data points to establish the transaction boundary:
1.1 Location (GPS)
Approximate geographic coordinates grounding you in the grid. This is required; you cannot proceed without granting location access.
1.2 Timestamp
The precise moment you enter the system (date, time, timezone). This marks the start of your bounded transaction.
1.3 Click ID
A unique session identifier linking your entry point to your eventual card and payment event (if applicable).
Why we collect this: to establish closed-loop integrity, prevent transaction bleeding, and create an audit trail for payment and legal compliance.
Legal basis (GDPR Art. 6): contractual necessity. These data points are required to perform the service agreement you enter by clicking “Conduct.”
2. Process Is Ephemeral
When you compose inside Composium, your interaction with the service is not logged, stored, or retained.
2.1 How It Works
- Input: you write prompts or provide current (raw signal)
- Transmission: your input travels to Claude API via Anthropic
- Processing: Claude conducts your input into form (SVG structure)
- Response: the output returns to your screen
- Flushing: all intermediate data is deleted immediately upon session termination
2.2 What We Don’t Store During Composition
- Your prompts (input current)
- Claude API responses (intermediate current)
- Session logs or interaction history
- Device fingerprints, browser data, or behavioral tracking
- Cookies (except minimal session authentication)
In effect: your process is witnessed but never recorded. The aperture stays open; nothing passes through us.
3. Payment Marks the Threshold
Payment signifies the moment your current becomes card—the conversion from liquid (ephemeral) to illiquid (stored).
3.1 What Happens at Payment
When you click “Finalize Composition” and complete payment via Stripe:
- Your composition is rendered as an SVG card
- The card is encrypted and stored in Supabase (our vault)
- A payment event is recorded (Stripe transaction ID, timestamp, amount, your email as one signifier)
- Your session is terminated; all liquid current is flushed
3.2 Stripe Integration
Stripe is our payment processor. We do not store or access your credit card details. Stripe holds all payment information per their privacy policy (stripe.com/privacy).
We receive only: transaction ID, amount (in EUR), timestamp, your email address (one signifier for invoice/receipt purposes).
4. Final Composition Only
After payment, your card is stored in our encrypted vault.
4.1 What We Store
- SVG composition: your final card, immutable and timestamped
- Metadata: Click ID, GPS entry point, creation timestamp, payment event ID
- Encryption: AES-256 at rest; Supabase manages encryption keys
4.2 What We Never Store
- Raw prompts or intermediate responses
- Your personal information beyond email (if authenticated)
- Behavioral data or interaction logs
- Device profiling or cookies beyond session authentication
4.3 Vault Access
Authenticated users: you can access your vault at composium.app/vault, where you see all cards created, their creation dates, and full card content. You can download, export, or delete any card.
Anonymous users: your card is stored for 60 days post-creation. You receive a delete link via email; you can request deletion anytime.
5. Third Parties
We work with three external services. We do not sell, share, or trade your data with any other party.
5.1 Anthropic (Claude API)
Purpose: language model processing to conduct your input into form. What they receive: your prompts only, during active composition. Storage: Anthropic does not store your prompts by default (no stored conversation threads enabled). Policy: anthropic.com/legal/privacy
5.2 Stripe (Payment Processing)
Purpose: secure payment processing. What they receive: payment card information, billing address, email. Storage: Stripe stores payment information per PCI compliance. Policy: stripe.com/privacy
5.3 Supabase (Data Vault)
Purpose: encrypted storage of your final compositions. What they receive: encrypted SVG cards, metadata (no raw prompts). Storage: geographic redundancy (EU data centers by default). Policy: supabase.com/privacy
We have Data Processing Agreements (DPAs) with all third parties ensuring GDPR compliance. Contact us to request DPA copies.
6. Data Retention
6.1 Anonymous Users
Card lifespan: 60 days from creation. Expiry action: automatic deletion from vault after 60 days. Manual deletion: you can request deletion anytime via the delete link sent with your card.
6.2 Authenticated Users
Card lifespan: indefinite (you own your cards). Your control: you can delete any card at any time. Account deletion: upon request, all cards and account data are deleted within 30 days.
6.3 Entry Metadata (GPS, Time, Click ID)
Retention: deleted upon session termination (when card is finalized or session expires). Exception: payment event metadata retained for 7 years (Finnish tax law compliance).
6.4 Stripe Payment Records
Retention: per Stripe’s retention policy (typically 7 years for regulatory compliance). Access: we receive Stripe’s own privacy-compliant reports; we do not store full records.
6.5 Supabase Backups
Backup retention: up to 90 days (for disaster recovery). Immutability: backups are read-only; your deletion requests override backups within 30 days.
7. Your Rights (GDPR & Finnish Data Protection Act)
As a data subject in the EU, you have the following rights under the General Data Protection Regulation (GDPR):
7.1 Right of Access
You can request a copy of all personal data we hold about you. How to exercise: email privacy@composium.co with “Data Access Request” in the subject line. We respond within 30 days.
7.2 Right to Rectification
You can request correction of inaccurate personal data. How to exercise: if authenticated, update your email in account settings. For other data, contact privacy@composium.co.
7.3 Right to Erasure (“Right to Be Forgotten”)
You can request deletion of all personal data we hold about you. How to exercise: email privacy@composium.co with “Data Deletion Request” in the subject line. We delete within 30 days, except where legal obligations require retention.
7.4 Right to Withdraw Consent
You can withdraw consent for location (GPS) logging at any time. Effect: withdrawing GPS consent means you cannot proceed with new compositions (GPS is mandatory for the transaction boundary).
7.5 Right to Data Portability
You can request a machine-readable export of all your data. How to exercise: email privacy@composium.co with “Data Portability Request.” We provide your cards in SVG, JSON, and archive formats within 30 days.
7.6 Right to Restrict Processing
You can ask us to restrict how we use your personal data. How to exercise: email privacy@composium.co. Note that restricting processing may prevent us from providing the service.
7.7 Right to Object
You can object to our processing of your personal data for legitimate interests. How to exercise: email privacy@composium.co with “Objection to Processing” in the subject line.
7.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the Finnish Data Protection Authority (Tietosuojavaltuutettu):
Finnish Data Protection Authority
Visiting address: Ratakatu 8 A, 00120 Helsinki, Finland
Email: tietosuoja@om.fi
Website: tietosuoja.fi/en
8. Data Security
8.1 Encryption
In transit: all data between your device and our servers is encrypted via TLS 1.3. At rest: cards in Supabase are encrypted using AES-256. Key management: Supabase manages encryption keys with secure key rotation.
8.2 Access Controls
Role-based access: only authorized staff can access data systems. Multi-factor authentication: required for all administrative access. Staff vetting: all employees pass background checks and sign confidentiality agreements.
8.3 Monitoring & Incident Response
Real-time monitoring: continuous logging and alerting for unauthorized access attempts. Incident response: we maintain a 24/7 incident response team. Breach notification: in the event of a confirmed data breach, we notify affected users within 72 hours per GDPR requirements.
8.4 Third-Party Security
Supabase is SOC 2 Type II certified. Stripe maintains PCI DSS Level 1 compliance. Anthropic (Claude) maintains SOC 2 Type II certification.
8.5 Your Responsibility
You are responsible for: keeping your account credentials confidential, enabling multi-factor authentication, protecting your device and browser security, reporting suspicious activity immediately.
9. Cookies & Tracking
9.1 Essential Cookies Only
We use minimal cookies solely for: session authentication (to keep you logged in), CSRF protection (to prevent cross-site attacks), language/preference settings.
9.2 No Analytics or Tracking
We do not use: Google Analytics or similar tracking tools, advertising pixels or conversion tracking, third-party data brokers, behavioral profiling or device fingerprinting.
9.3 Cookie Management
You can delete cookies from composium.app at any time via your browser settings. Deleting session cookies will log you out.
10. International Data Transfers
Composium OY is based in Helsinki, Finland (EU). Supabase hosting defaults to EU data centers.
10.1 For EU Residents
If you reside in the EU, your personal data is processed and stored within the EU by default, ensuring full GDPR compliance with no international transfers.
10.2 For Non-EU Residents
If you access Composium from outside the EU, your data may be transferred to Supabase’s US data centers (or your region’s default). By using the service, you consent to this transfer and authorize Composium OY to process your data in the US under: Standard Contractual Clauses (SCCs) — EU-approved legal mechanisms for international transfers; Supabase Data Processing Agreement — incorporating SCCs per Commission Decision 2021/914.
11. Children’s Data
Composium is not intended for individuals under 18. We do not knowingly collect data from minors.
If you are under 18, please do not use Composium. If we discover we have collected data from a minor, we will delete it immediately.
12. Changes to This Policy
12.1 Notification
Minor changes: posted at composium.studio/privacy with updated “Last Updated” date. Material changes: we notify you via email (if authenticated) or in-app banner at least 30 days before the change takes effect.
12.2 Your Acceptance
Continued use of Composium after policy changes constitutes acceptance of the updated policy.
13. Contact Information
Email: privacy@composium.co
Mailing Address:
Composium OY
Helsinki, Finland
Registration: 3568278-5
Data Protection Officer (DPO): dpo@composium.co
We aim to respond to all privacy inquiries within 10 business days.
14. Legal Basis Summary (GDPR Art. 6)
| Data Type | Purpose | Legal Basis |
|---|---|---|
| GPS, Time, Click ID | Establish transaction boundary | Contractual Necessity |
| Email (if authenticated) | Account management, receipts | Contractual Necessity |
| Payment metadata | Billing and tax compliance | Contractual Necessity + Legal Obligation |
| SVG card | Provide the service output | Contractual Necessity |
| Stripe transaction ID | Fraud prevention, audit trail | Legitimate Interest |
15. Entire Agreement
This Privacy Policy, together with our Terms of Use and the In-App Transaction Agreement (available at composium.studio/terms and within composium.app), forms the complete privacy and data handling agreement between you and Composium OY.
If any part of this policy is found to be unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in full effect.
Composium OY
Helsinki, Finland
composium.co · composium.studio · composium.app
August 16, 2026
This Privacy Policy is governed by the laws of Finland and the General Data Protection Regulation (EU) 2016/679.